Security Boundaries in AI Coding: How Far Should We Let Agents Go